From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f71.google.com (mail-ot1-f71.google.com [209.85.210.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7495134CFD0 for ; Mon, 24 Aug 2026 02:20:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.71 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787538009; cv=none; b=NByoSx0nRyDn2XzbqH2uIzKto+G9NJajBAy9tyikfbtFKyYpKuI9IhwN0bHiR328Ymw7vM3uIFvtgbTKaUyXE/F2L5qCDHllMDN8HgSC/dtdKzp38rVZCIKUsCF8XRf8Rn99SFzBKsRUDHwtgUtpSCPyvqFPeBJ0uCE0Rtecd5c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787538009; c=relaxed/simple; bh=msLtnV5yGOxf1cTuBQ48+3wbNDyjLIs3etaEyrVIVzo=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=i6q4IjDRj1DHcqMCUYA3apcDm209OMGsHT8VnEmIGmMs0Up1OecS4/ceRkNs5PqoWqE1EP9fqIuwKV4MZBfGPV+PQ0oamxzlOD7Mnq9/SkVhp3f3fmyTtsxf7BCaKXHJZtpzYd2y9m3Ygd1guM4yHSoP+OoEGmgFFFf2pdm0a+s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.210.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-ot1-f71.google.com with SMTP id 46e09a7af769-7ee59eeb8c1so2425199a34.0 for ; Sun, 23 Aug 2026 19:20:07 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787538006; x=1788142806; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=gB7YYgrLswnVEMO0KU/RoRiLFCD+Ma41YQ8DCX7B2x0=; b=mhmcRmxn5AQ4jClDNqksWn/hlN/GMITjGEZu01O82h/0wJAb8H5D3zOXT2Gf5iPuSc zg2uAykBoANpB8el/KyvB7UMCtnDKpGZyij0aa+zheurAS44hjoNfTpbej06oKMA9OkA CqTSm8QFIhShfbAu8++qGlGHbSOdxLGy6JlXUh4uqAAFoqH4SE7rSIOL2ZuLh15KJIUu js4YkzroZr9erHa9uWEzoEN4pSw2CkBQtEpzSWw7Lggt2v3HYaYbxUJypVeN3A9FZmWr x86mgjkbTxK1EDOmCLYAgeuu4ar83hdU8MdaZumlDB0mw/32/6FD0Cz23NNnJld7JYi2 ibvA== X-Forwarded-Encrypted: i=1; AHgh+RqwRXw0KC/ezkrzwYOf2z11bqDt6ii4EhxMI/GzUuEmiYBswUzDcM25oW0U3eK3WW2NRgdCXAyoP4n/W7c=@vger.kernel.org X-Gm-Message-State: AFuF++mAEaw7n3gISTJsBRaXCfHrDNtTJoQIVh3yhYlLdPWyQ4ohB1oJ 3D60ceHZ68/s5rQAT9vQBElQs2QnJYNi4lSPMpUE/zR0pNZ9YBPCFq2XApzO7gEE62cgZAV4w3k PLsKH8ZZUAvmPVlsdzIZst3ArwkKHq538Am3XMs9h606Xtlj6x8MRa0QGB80= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a4a:e1d3:0:b0:6b1:4b76:1c18 with SMTP id 006d021491bc7-6b16b3ea256mr10971071eaf.24.1787538005151; Sun, 23 Aug 2026 19:20:05 -0700 (PDT) Date: Sun, 23 Aug 2026 19:20:05 -0700 In-Reply-To: <20260824015334.56759-1-kmehltretter@gmail.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a8baa55.ae6ddae5.3da009.0072.GAE@google.com> Subject: Re: [syzbot] [kernel?] KASAN: slab-use-after-free Write in bus_for_each_drv From: syzbot To: kmehltretter@gmail.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: WARNING: refcount bug in usb_add_gadget ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#1: syz-executor381/5998 Modules linked in: CPU: 1 UID: 0 PID: 5998 Comm: syz-executor381 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25 Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 4b ae 02 fd 48 8d 3d f4 64 f7 0a 67 48 0f b9 3a eb 4a e8 38 ae 02 fd 48 8d 3d f1 64 f7 0a <67> 48 0f b9 3a eb 37 e8 25 ae 02 fd 48 8d 3d ee 64 f7 0a 67 48 0f RSP: 0018:ffffc90003d87968 EFLAGS: 00010293 RAX: ffffffff84c329f8 RBX: 0000000000000002 RCX: ffff888031b29f00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8fba8ef0 RBP: 0000000000000000 R08: ffff888031b29f00 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff88803b7285d8 R13: 0000000000000000 R14: ffff888025decd90 R15: dffffc0000000000 FS: 00007f4ec54416c0(0000) GS:ffff888125d35000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f413f414140 CR3: 00000000400de000 CR4: 00000000003526f0 Call Trace: __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] kref_get include/linux/kref.h:45 [inline] kobject_get+0xfa/0x120 lib/kobject.c:643 get_device drivers/base/core.c:3868 [inline] device_add+0x24/0xb80 drivers/base/core.c:3648 usb_add_gadget+0x47d/0x700 drivers/usb/gadget/udc/core.c:1461 usb_add_gadget_udc_release+0x1a4/0x1f0 drivers/usb/gadget/udc/core.c:1517 dummy_udc_probe+0x6e1/0x7e0 drivers/usb/gadget/udc/dummy_hcd.c:1121 platform_probe+0xf9/0x190 drivers/base/platform.c:1439 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 device_driver_attach+0xe0/0x1d0 drivers/base/dd.c:1203 bind_store+0x1d3/0x220 drivers/base/bus.c:267 kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x61e/0xbb0 fs/read_write.c:687 ksys_write+0x156/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ec549e1de Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08 RSP: 002b:00007f4ec5440f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f4ec54416c0 RCX: 00007f4ec549e1de RDX: 000000000000000b RSI: 00007f4ec54e71b9 RDI: 0000000000000003 RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000010 R14: 00007ffc9aa26bd0 R15: 00007ffc9aa26cb8 ---------------- Code disassembly (best guess): 0: eb 66 jmp 0x68 2: 85 db test %ebx,%ebx 4: 74 3e je 0x44 6: 83 fb 01 cmp $0x1,%ebx 9: 75 4c jne 0x57 b: e8 4b ae 02 fd call 0xfd02ae5b 10: 48 8d 3d f4 64 f7 0a lea 0xaf764f4(%rip),%rdi # 0xaf7650b 17: 67 48 0f b9 3a ud1 (%edx),%rdi 1c: eb 4a jmp 0x68 1e: e8 38 ae 02 fd call 0xfd02ae5b 23: 48 8d 3d f1 64 f7 0a lea 0xaf764f1(%rip),%rdi # 0xaf7651b * 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction 2f: eb 37 jmp 0x68 31: e8 25 ae 02 fd call 0xfd02ae5b 36: 48 8d 3d ee 64 f7 0a lea 0xaf764ee(%rip),%rdi # 0xaf7652b 3d: 67 addr32 3e: 48 rex.W 3f: 0f .byte 0xf Tested on: commit: d58772d8 Merge tag 'regmap-fix-v7.2-rc7' of git://git... git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=164c1179580000 kernel config: https://syzkaller.appspot.com/x/.config?x=6ddb3079499f48cb dashboard link: https://syzkaller.appspot.com/bug?extid=9cb1ac7fce4944ba9165 compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=11b98979580000